.github/workflows/boring.yaml

name: package:boring
permissions:
  contents: read

on:
  # Run on PRs and pushes to the default branch.
  push:
    branches: [ main ]
    paths:
      - '.github/workflows/boring.yaml'
      - 'pkgs/boring/**'
  pull_request:
    branches: [ main ]
    paths:
      - '.github/workflows/boring.yaml'
      - 'pkgs/boring/**'
  schedule:
    - cron: "0 0 * * 0"
  # Also runs the refresh job.
  workflow_dispatch:

defaults:
  run:
    working-directory: pkgs/boring/

jobs:
  # Check code formatting and static analysis on a single OS (linux)
  # against Dart dev.
  analyze:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        sdk: [dev]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: ${{ matrix.sdk }}
      - id: install
        name: Install dependencies
        run: dart pub get
      - name: Check formatting
        run: dart format --output=none --set-exit-if-changed .
        if: always() && steps.install.outcome == 'success'
      - name: Analyze code
        run: dart analyze --fatal-infos
        if: always() && steps.install.outcome == 'success'

  # Build BoringSSL from source with the build hook and run the tests on each
  # desktop OS.
  test:
    needs: analyze
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        sdk: [stable]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: ${{ matrix.sdk }}
      - name: Setup NASM
        if: runner.os == 'Windows'
        uses: ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b
      - id: install
        name: Install dependencies
        run: dart pub get
      - name: Run tests
        run: dart test
        if: always() && steps.install.outcome == 'success'

  # Check the bundled BoringSSL and the bindings against Project Wycheproof.
  conformance:
    needs: analyze
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: stable
      - name: Install dependencies
        run: dart pub get
      - name: Run Wycheproof conformance tests
        run: ./tool/run_conformance_tests.sh

  # Check X.509 path validation against x509-limbo.
  x509-limbo:
    needs: analyze
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: stable
      - name: Install dependencies
        run: dart pub get
      # limbo.json is ~40 MB, and the revision is pinned in the runner script.
      - name: Cache x509-limbo testcases
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
        with:
          path: pkgs/boring/build/x509-limbo
          key: x509-limbo-${{ hashFiles('pkgs/boring/tool/run_x509_limbo_tests.sh') }}
      - name: Run x509-limbo conformance tests
        run: ./tool/run_x509_limbo_tests.sh

  # Re-run the vendoring script at the pinned revision, which also regenerates
  # the bindings, and fail if that changes anything. This keeps the checked-in
  # sources and bindings in sync with tool/REVISION.
  generated:
    # The bindings include struct layouts from the glibc headers, so they are
    # generated on a fixed image. Keep in sync with the refresh job.
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: dev
      - name: Regenerate at tool/REVISION
        run: ./tool/bump-boringssl-revision.sh "$(cat tool/REVISION)"
      - name: Check for changes
        run: |
          if [ -n "$(git status --porcelain -- .)" ]; then
            git status --short -- .
            echo "::error::Generated files are out of date. Run ./tool/bump-boringssl-revision.sh \"\$(cat tool/REVISION)\" in pkgs/boring and commit the result."
            exit 1
          fi

  # Weekly (and on manual runs), update BoringSSL to its latest revision and
  # open a PR if anything changed. The Dart Bot token is needed so that the
  # PR's CI runs.
  refresh:
    if: >-
      github.repository_owner == 'dart-lang' &&
      (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
    # Keep in sync with the generated job.
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Generate Dart Bot token
        id: generate-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
          client-id: ${{ vars.ECOSYSTEM_BOT_CLIENT_ID }}
          private-key: ${{ secrets.ECOSYSTEM_BOT_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          token: ${{ steps.generate-token.outputs.token }}
          persist-credentials: false
      - uses: dart-lang/setup-dart@7654d458321ee25acccccfdb86cd48bd95768ff1
        with:
          sdk: dev
      - name: Update BoringSSL
        id: refresh
        run: ./tool/bump-boringssl-revision.sh
      - name: Check for changes
        id: check_changes
        run: |
          if [ -n "$(git status --porcelain -- .)" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Install changelog updater
        if: steps.check_changes.outputs.changed == 'true'
        run: |
          dart install --git-path pkgs/repo_manage https://github.com/dart-lang/ecosystem.git
          echo "$HOME/.local/state/Dart/install/bin" >> "$GITHUB_PATH"
      - name: Update changelog
        if: steps.check_changes.outputs.changed == 'true'
        run: report changelog "Update BoringSSL to ${SHORT_REVISION}."
        env:
          SHORT_REVISION: ${{ steps.refresh.outputs.short_revision }}
      - name: Create pull request
        if: steps.check_changes.outputs.changed == 'true'
        uses: peter-evans/create-pull-request@653ba8b281fa5e1ee78ec20dda96cf9a79102c04
        with:
          token: ${{ steps.generate-token.outputs.token }}
          committer: dart-ecosystem-bot <dart-ecosystem-bot@google.com>
          author: dart-ecosystem-bot <dart-ecosystem-bot@google.com>
          add-paths: pkgs/boring
          commit-message: "[boring] Update BoringSSL to ${{ steps.refresh.outputs.short_revision }}"
          branch: "boring-update-boringssl-${{ steps.refresh.outputs.short_revision }}"
          title: "[boring] Update BoringSSL to ${{ steps.refresh.outputs.short_revision }}"
          body: >-
            Automated update to the latest BoringSSL revision
            [`${{ steps.refresh.outputs.revision }}`](https://boringssl.googlesource.com/boringssl/+/${{ steps.refresh.outputs.revision }}),
            generated by `pkgs/boring/tool/bump-boringssl-revision.sh`.
          delete-branch: true